“Both sources said the attackers used the S3 access to copy and exfiltrate several terabytes worth of Sisense customer data, which apparently included millions of access tokens, email account passwords, and even SSL certificates.”
Sisense sells a dashboard that holds the keys to every other service its thousand-plus customers use. Attackers reportedly got into its self-hosted Gitlab, found a credential to its Amazon S3 buckets, and walked off with terabytes. The company’s first notice said the matter “has not resulted in an interruption to our business operations.” Its PR firm asked for a chance to comment, then declined once Krebs laid out the details. Customers get to rotate every secret they ever trusted it with.